Help with a query to calculate percentage

[sunny_871]

Hello, I am working on a query where I need to set an alert based on failure percentages. Calculating the failure percentage is the tricky part. Here is my sample query - 

index=myindex  (status=success OR status=inprogress) 
| bin _time 
| stats count(eval(like(status, "success"))) as success count(eval(like(status, "inprogress"))) as inprogress by id _time 

The conditions for access and failure are as below -

Success - 

| where success = 1 AND inprogress >=1

Failure -

| where success = 0 AND inprogress >=1

Now I want to create an alert based on failure percentage of 10%. How do i calculate the failure and success percentage here? The id you are seeing in the BY clause is nothing but customer ID so I'd like to get alerted based on 10% failure,

Best Regards

[ITWhisperer]

Your search looks a little odd for what you are trying to do although it does depend on your data.

Since you have _time in your by clause, it is likely that your success count is likely to be either 1 or zero, same with the inprogress count.

If you remove the _time from your by clause, you will get the counts across the whole of the time period of the search (which might be what you actually want)

You can then do an eval based on your criteria for success or failure and count those again over the time period of your search using another stats command.

Finally, you can do an eval to determine the percentage success of all the events within the time period

[sunny_871]

Hi @ITWhisperer Thanks for the response. I have removed the _time.

Sorry how would i create or generate an eval with the below success and failure conditions? Could you give me a guidance.,

Best Regards,
Shashank

[ITWhisperer]

| eval status=case(success = 1 AND inprogress >=1, "success", success = 0 AND inprogress >=1, "failure")